Entra ID – How to Reset MFA for User in B2C Tenant

It may be that the account is both a valid Microsoft Account (formerly Live ID) AND a valid Organisational Account (Azure AD). This can happen (you have a Live ID for years then your company signs up for Office 365) and leads to all sorts of fun and games because 'home realm discovery' defaults to Azure AD.

In the first login box provided by Azure try typing any address with an '@outlook.com' address - you will be redirected to the Outlook login page (which uses Live IDs). On the Outlook login page enter your 'david@mycompany.co.uk' email and password. I expect you'll login.

I talk about the background (and reason) for this scenario on my blog.

If I understand your scenario, an actor has stolen both the users laptop and IPhone (which apparantly in Sweden is stored with the laptop) and you've not configured either autofill or password storage settings in edge. You've also not configured any of the sensitive content on the locks screen settings.

But your contention is that the MFA app is the problem...

Your logic appears flawed. The most obvious problem is that keeping the iPhone and laptop together defeats the point of MFA. The app should be on a device separate from the laptop.